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Abstract 

The last decade, online activism has vastly 
grown. In the current digital society, from 
time to time citizens decide to express 
their opinion by attacking large corpor- 
ations digitally in some way. Where the 
activists claim this to be a digital as- 
sembly, others see it as criminal offences. 

In this paper, we will explore the legal 
and technical borders of the digital right 
to assembly. By doing so, we can gain in- 
sight into digital manifestations and make 
up the balance on the digital right to as- 
sembly. As an additional contribution, we 
will discuss how the digital right to as- 
sembly could be granted and which legal 
and technical requirements should be set 
for a digital assembly. 



Keywords 

Right to Assembly, Digital Assembly, Dis- 
tributed Denial of Service (DDoS), Virtual 
Sit-In, Digital Blockade. 



j . slobbeOstudent . tue . nl 



s . 1 . c . verberktSstudent . utwente . nl 



1. Introduction 

Due to groups like "Anonymous" and 
"LulzScc", distributed denial of service 
(DDoS) attacks beca me a re turning topic 
m newspapers fTeffer l2010bh . Not only are 
the inner workings of a DDoS attack often 
misunderstood by the general public, the 
recent avalanche of attacks also showed a 
new phenomenon: the DDoS attacks were 
claim ed to be an act of activism (Schouten 
l2010h . 

In this paper, we will investigate the use 
of a DDoS attack as a means of exercising 
the right of assembly 1 . Furthermore, we 
will also discuss how a digital right to as- 
sembly could be embodied in current le- 
gislation. For this embodiment, we will 
base ourselves on the characteristics of the 
right to assembly and how this relates to 
the digital world. We will also present 
a set of both legal and technical require- 
ments a digital assembly should comply 
with. 

We will start out with discussing the 
general terminology, in Section [2J where 
we will discuss, amongst others, the 
(D)DoS, (online) activism, and the legal 
subsidiarity problem. Afterwards, the 
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legal part of this paper commences with 
a short survey of the right of assembly, in 
Section [3] In this survey, we will discuss 
notable characteristics of digital availab- 
ility attacks in the light of the right to 
assembly. This is followed by a discussion 
of attacks on availability in criminal law, 
in Section^ which also notes recent case 
law on the (D)DoS. Before the legal sec- 
tion is concluded, in Section[?l we will dis- 
cuss the policy of the public prosecutor, in 
Section [5j and civil disobedience, in Sec- 
tion [6] Finally, we will focus on embody- 
ing the right to assembly discussing the 
option to embed it in the current legisla- 
tion or to formulate complete new legis- 
lation and thereby set requirements to a 
digital assembly, in Section HH followed by 
a technical adoption, in Section 1101 

1.1. Related work 



According to Klang (2005), the current 
legislation criminalising DDoS attacks in 
the name of (cyber)terrorism have a seri- 
ous effe ct on the civil rights of individuals. 
Klang (|2005h vouches for a more modest 
approach to the DoS technique, which is 
not build upon the notion of cyberterror- 
ism. 



Kreimer (200 lj) states that the digital 
world has the potential of facilitating so- 
cial movements of all sorts and is increas- 
ingly being used for this cause 2 . In his 
paper, besides discussing the value of the 
digital world for social movements as well 
as the risks, he also touches on the phe- 
nomenon of hacktivism. The three dis- 
cussed approaches to hacktivism are di- 
gital graffiti, political attacks on systems 
- under which he categorises the virtual 
sit-in, which is discussed in detail in Sec- 
tion !2.2l -. and the digital release of secret 
i nform ation. In his argument, Kreimer 
(|200l[ ) states that the virtual sit-in is 



probably as legal as repeatedly shouting 
with the goal of making verbal commu- 
nication im possib le. 

Samuel (|2004r ) constituted a very de- 
tailed and broad overview of hacktivism 
and all its forms. One of the types dis- 
tinguished is the performative hacktivism, 
which she describes as legally ambigu- 
ous. The group of performative hacktiv- 
ists tries to take a more artistic approach 
to pressing political issues. As one of their 
instruments, the virtual sit-in is named. 



Samuel (2004) notes that the virtual sit- 
in may be a legal version of the DDoS. 

2. Terminology 

Since this paper offers a cross disciplin- 
ary perspective on digital assemblies and 
related subjects, consisting of both com- 
puter science and legal studies, we will 
start with the establishment of termino- 
logy. This way, we can acknowledge the 
different meanings of terms based on the 
different fields of science and to prevent 
us from misunderstandings. In this sec- 
tion, we will touch upon the phenomena 
of (distributed) denial of service, (virtual) 
sit-ins, (online) activism, (cyber)terrorism 
and other subjects fundamental to this re- 
search. 

2.1. (D)DoS 

A denial of service (DoS) attack can be 
defined as an attack o n the availability 
of a system (Anderson l2008f ) . A distrib- 
uted denial of service (DDoS) attack is the 
same type of attack, but the attack ori- 
ginates from multiple parties. There are 
multiple techniques for executing a denial 
of service attack on a com puter system 
(Kang, Zhang and Ju 2006). Currently, a 
way to distinguish attacks is based on the 
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method of attack. The method of flood- 
ing boils down to sending lots of data to 
a server until the maximum capacity is 
reached and the machine is unable to pro- 
cess new data requests or only able to do 
so very slowly. This type of attack is most 
often executed in a distributed fashion - 
possibly using a network of hacked com- 
puters -, because it takes lots of data re- 
quests for a server to become unavailable. 
Notice that this technique is also used for 
load balance testing - tests aimed at find- 
ing out the maximum number of users a 
system can take. 

Another method of attack is by exploit- 
ing known weaknesses in the software used 
on the server. Sending a single malicious 
request to the target could lead to the 
server software entering a deadlock, crash- 
ing, or otherwise being pushed into deny- 
ing service to other clients. One com- 
mon technique to disable a server that 
uses a relational dat abase is SQL injection 
(Kindy and Pathan l201lf ). SQL Injection 
is a type of attack on a Web application 
where the attacker provides SQL code - 
the language used to query databases - 
as user input to perform unauthorized ac- 
tions. This type of attack may allow a 
single attacker to shut down the service. 

However, there are methods that lie in 
between. For example, the DNS ampli- 
fication atta ck, a s described by Vaughn 
and Evron ((2006), abuses a property of 
the DNS infrastructure - the subsystem 
responsible for translating domain names 
to IP-addresses. This makes it possible 
for an attacker to generate 8.5 times more 
traffic then with an ordinary (D)DoS at- 
tack. Therefore, the critical group of at- 
tackers, in case of a distributed attack, is 
decrease by a proportion 8.5. 

When regarding the physical world, the 
usage of a method such as DNS amplific- 
ation can be compared to a group of pro- 



testers blocking a bottleneck of a build- 
ing, e.g. a single entry to the construction. 
The impact of this group increases signi- 
ficantly by the use of a bottleneck, when 
compared to their impact in an open field. 
In this paper, we will consider whether 
this is on the verge of permissible use of 
weaknesses in an assembly or not. 

Of course, the discussed techniques can 
also be combined. For example, it is pos- 
sible to use one of the techniques men- 
tioned to attack other services, causing 
the operating system to fail and making 
the intended service unavailable. 

For average users, some of the tech- 
niques may be hard to understand. 
However, there exist tools that al- 
low for an attack by means of a 
simple click on a button. Such 
tools are, for example: TFN, TFN2K, 
Mstream, Naphta, Stacheldracht-V2.66, 
Stacheldrachtv4, Trinoo, Shaft, IRCbots, 
FAPI, Targa, Trini ty, L OIC 3 (Dietrich, 
Long and Dittrich 2000f ). For the sake 
of simplicity, we exclude physical (D)DoS 
attacks. In the rest of this paper, the 
(D)DoS attack is defined as an attack on 
the availability of an information system 
from one or more remote systems capable 
of achieving its goal - causing unavailab- 
ility. 

2.2. Virtual Sit-ins 

The virtual sit-in is when a large group 
of people rap idly r eloads a specific web 
page (Samuel |200i). This method is pop- 
ularised by a group of activists that calls 
themse lves t he Electrohippies Collective 
(Klang |2005j). As opposed to traditional 
distributed denial of service attacks, this 
method requires the consent and active 
participation of every participant. Thus, 
the virtual sit-in requires a critical mass 
in order to be of any effect. 
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Furthermore, the method of virtual sit- 
ins does not use the system different from 
the normal use, besides that the amount 
of requests is a lot higher than the nor- 
mal case. In other words, the virtual sit-in 
does not abuse the system in a technical 
sense, e.g. using an exploit. 

2.3. Online Activists 



Samuel (|2004h defines those that non- 
violently use illegal or legally ambiguous 
digital tools in pursuit of political goals as 
hacktivists. According to her, hacktivists 
are a special kind of online activists, that 
do not necessarily obey order. In other 
words, they show civil disobedience in the 
digital world. We can apply this notion 
of hacktivism to our view on digital act- 
ivists. This also encapsulates online civil 
disobedience. 

In the digital world, activists may be- 
have disobedient f or pol itical reasons. Ac- 
cording to Klang ( 20051 ). these online act- 
ivists exercise their fundamental rights to 
freedom of expression 4 and assembly 5 . 

To give a bit more context, we will 
describe some characteristics from two 
self proclaimed prominent digital activist 
groups. As will be explained, these ex- 
amples do not qualify as digital assem- 
blies. 

2.3.1. Anonymous 

One distinctive characteristic of Anonym- 
ous is the fact that it does not have a uni- 
form political opinion with the seemingly 
exception of the ideal of absolute freedom 
on the Internet - e.g. no filtering, censor- 
ship or content based payment should be 
allowed in their opinion. The communic- 
ation is decentralized over a broad supply 
of communication channels, such as im- 
age boards, mailing lists and IRC chan- 



nels. Since the communication is distrib- 
uted and the participants are eclectic in 
their opinions, there is not and cannot be 
a leader nor spokesmen. Therefore, every 
digital protest and no digital protest at 
all can originate from Anonymous at the 
same time. 

One should always question a press 
statement by Anonymous, because 
chances are high that a statement is false 
- note that blaming Anonymous is an 
effective way to masquerade a digital at- 
tack. The general method of Anonymous 
consists of specifying a target and using 
the method of DDoS for taking it down, 
while asking for other participants on the 
internet. 

2.3.2. LulzSec 

In comparison to Anonymous, LulzSec fo- 
cuses on the confidentiality of a system 
rather then the availability of a system. 
LulzSec claims to actively hack systems 
to publish personal data and credentials 
stored by governments and multinational 
corporations. Self proclaimed members of 
LulzSec also claim to have delivered im- 
portant documents to WikiLeaks. 

Besides the ideal of absolute freedom 
on the Internet, these activists share an 
ideal of transparency of the government 
and corporations to the society. It also 
holds for LulzSec that they do not have 
a spokesmen or leader. Therefore, every 
statement should be treated with suspi- 
cion, since the name of the group could 
be misused to hide another attacker. 

Under current legislation, it is clear that 
the activities of LulzSec are illegal, as they 
fall within the scope of offences such as 
intrusion of information systems 6 . We 
briefly discussed some characteristics of 
LulzSec to provide an accurate overview 
of hacktivism, but will not consider them 
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nor refer to them in the rest of the paper. 

2.4. The Legal Problem of 
Jurisdiction 

Two important legal problems arise when 
concerned with legislation in the digital 
world. First, we have the subsidiarity 
legal problem - or the problem of jurisdic- 
tion. As the digital world is much larger 
than country borders prescribe, it is diffi- 
cult to cope with cases where the national 
legislation of two countries differ. At the 
same time, world wide legislation is not 
easily made - not even to mention enforce- 
ment. We will not discuss this problem in 
depth, as it is an entire issue in itself, but 
it should be noted. 

The second problem is the broad spec- 
trum of already existing conventions, 
which should be taken into account. In 
our case, the Budapest Convention on 
Cybercrime is of importance, which re- 
quires the national governments to crim- 
inalise the serious hindering of computer 
systems 7 . Of course, this convention com- 
plies with fundamental rights and imple- 
ments related safeguards 8 . In Section |8l 
we will return to this issue. 

2.5. Technology Change and the 
Impact on Law 

It is important to have technology neut- 
ral legislation, to the extent this is pos- 
sible. This means that the legislator may 
be aware of the technologies at hand, but 
does not propose legislation that is spe- 
cifically aimed at a certain technology. For 
example, if an expensive DDoS-attack pre- 
vention mechanism is invented, legislation 
that permits specifically DDoSes as form 
of assembly would be rendered mostly 
useless. However, it may be clear that 
with multidisciplinary problems, such as 



those discussed in this paper, the legis- 
lator should provide a technical appendix. 



3. Fundamental Rights and 
Digital Demonstrations 

The right of assembly refers to the fun- 
damental right for everyone to have a 
peaceful assembly, which is granted in the 
European Convention on Human Rights 9 . 
This charter also grants the related right 
of freedom of expression 10 . The right of 
assembly may only be restricted when it is 
done lawful, necessary in a democratic so- 
ciety and this is in the interest of national 
security or public safety, for the preven- 
tion of disorder or crime, for the protec- 
tion of health or morals, or for the protec- 
tion of the rights and freedoms of others 11 . 

In the Netherlands, the right of as- 
sembly is granted in the Dutch Constitu- 
tion 12 , as is the right of freedom of ex- 
pression 13 . Nevertheless, in practice, the 
rights granted by the European Conven- 
tion on Human Rights 14 is more import- 
ant. This is due to the fact that the courts 
may not judge acts of parliament and 
treaties for compliance with the Dutch 
constitution 15 . The right of assembly is 
regulated in Dutch legislation via the Pub- 
lic Manifestations Act 16 (Fcrdinandusse 



200f|). Restrictions may only be imposed 
for protection of health or traffic, or to 
fight or prevent disorder 17 . 

It is important to note that the art- 
icle of the Dutch constitution that grants 
the right of assembly in its current form, 
only cam e into force on 17 February 1988 
(Schilder Il989h . Since that change, the 
constitution, literally translated, grants 
the right of assembly and manifestation 18 , 
where the change boils down to the ad- 
dition of manifestation 19 . The legislator 
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notes that manifestation refers to a group 
of people publicly expresses their emotions 
or wishes concerning a social or political 
subject 20 . As, Schilder (|l989f ) notes, this 
may be seen as a collective form of the 
freedom of expression. 

Finally, in Germany, the constitution 
grants the right of peaceful assembly 
without registration and permission 21 . 
However, this right may be limited when 
the assembly is in the open and the limit- 
ation is lawful 22 . 

3.1. The Blockade as an 
Assembly 

Schilder f|l989h notes that the Dutch le- 
gislator, in response to the question if 
a blockade may fit within the definition 
of an assembly, remarked that an action, 
where the aspect of collective expression 
has faded in favour of a coercive character 
towards the government or a third party, 
cannot be seen as an assembly as meant 
in the constitution 23 . However, later the 
Minister of Internal Affairs added that 
this does not mean that a manifestation 
cannot h ave ch aracteristics of a blockade. 
Schilder (1989) summarises that as long as 
an assembly in the form of a blockade does 
not have the goal of imposing a decision 
or action, it fits the definition. 

In 1996, the court of appeal judged 
in a case between a chlorine producer 
Solvay and environment defence organisa- 
tion Greenpeace 24 . Greenpeace had de- 
cided to impose a blockade on the chlorine 
transport of Solvay. Due to the fact that 
Greenpeace did not notify Solvay, did not 
consult the company on the consequences, 
did not leave room for alternatives, and 
did not clarify on the duration of their 
blockade, the intervention with the affairs 
of Solvay subordinated the interests of the 
company overly to the interests pursued 



by Greenpeace. This resulted into the 
court ruling that the action of Greenpeace 
should be qualified as a tort. 

Furthermore, the Greenpeace vs Solvay 
case shows that the freedom of expres- 
sion 25 may provide the right to infringe 
other rights 26 . However, due to the com- 
plete inconsideration of the interests of 
Solvay, this argument does not hold. Sim- 
ilarly, a ruling of the court of appeal in 
The Hague showed that a blockade may 
be allowed in the context of a strike under 
very strict circumstances 27 . 

In another case against Greenpeace, ori- 
ginating from the summer of 1982, the 
court states that as it is unavoidable that 
some damages occur during an assembly, 
this should be allowe d to a certain de- 
gree (Schilder Il989h . Furthermore, per 
action, there should be tailored criteria 
based on to which extent the performing 
party pursues a general interest, to which 
extent this could be pursued differently, 
and the proportionality between the pos- 
sible damages and the pursued goal of the 
action 29 . 

Although the additional requirement of 
peacefulness to the German right of as- 
sembly 30 seems unclear, especially when 
concerned with blockades, the legislator 
provides clarification in the German Act 
on A ssemblies and Processions (Schilder 
1989). This act states that an assembly 



may only be prohibited in individual 
cases, where the organising party or his 
supporters - not others that want to cre- 
ate havoc at the expense of the assembly 
- have a violent or inflammatory goal 31 . 

The German constitutional court has 
ruled that blockades - in this specific 
case sit-ins - are not outside the scope of 
the right of assembly, just because parti- 
cipants are accused of violent coercion 32 , 
as the constitutional notion of peaceful- 
ness is not as narrow as the broad defin- 
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ition of violenc e in th e law seems to dic- 
tate f Schilder IToSflh . However, six years 
later, the constitutional court ruled that 
the term assembly should be interpreted 
as an orderly gathering of people parti- 
cipating in the public building of opinion, 
with a focus on discussion or manifesta- 
tion 34 . Furthermore, this ruling decided 
that it is not up to the parties acting upon 
their right to assembly to decide how the 
colliding rights of others may be limited. 
Thus, blockades are allowed to that extent 
where they are the normal side effect of an 
assembly, and not when its the goal of the 
assembly to hinder. 

3.2. Assemblies in Privately 
Held Locations 

If and to what extent rights also have a 
third-party applicability - or horizontal 
function, which means that they can also 
hold between two private parties and not 
only between a private party and the gov- 
ernment - is not stated in the European 
Convention on Huma n Rights (Haeck and 
Vande Lanotte 120051 ) . However, it is clear 
that the European Court of Human Rights 
does not accept direct third-party ap- 
plicability 35 . Nevertheless, as Haeck 



and Vande Lanotte (2005) remark, the 
European Court on Human Rights has 
accepted cases concerning indirect third- 
party applicability including cases con- 
cerned with the right of assembly 36 . In 
such member state gets sued for 

not protecting the fundamental rights of a 
citizen against a third party. 

The Dutch legislator remarks that fun- 
damental rights may also have a hori- 
zontal fu nction 37 . As Haeck and Vande 
Lanotte (|2005h note, the legislator states 
that the third-party applicability is to be 
decided by the judge and not the legis- 
lator. Thus, this is comparable to the 



European case, where the judge has to bal- 
ance the interests of the community and 
those of the releva nt parties. 

Schilder (Il989h discusses the Hoog 
Cathcrijne-issue, named after the 
privately held shopping mall at the 
central station in Utrecht. Due to 
the very public character of the mall, 
which is highlighted even more by its 
function as passageway, congress facil- 
ity, and recreational area, the right of 
assembly is applicable - assuming that 
the fundamental right of assembly is not 
solely meant for protection against the 
government, but also has a horizontal 
function. 

It is important that the assembly has 
a public character, as the Dutch legis- 
lator notes 38 . Of course, it clearly does 
not make sense to have a manifestation 
in a location where nobody is able to see 
it. The Dutch Public Manifestations Act 
defines public locations as places that by 
function or normal usag e are open to the 
public 39 . As Schilder (|l989f ) mentions, 
strikes are a bit different in this respect, 
as they normally happen at the workplace. 
Furthermore, the freedom of choice of loc- 
ation and time of the assembly is deemed 
important 40 - this can also be concluded 
from the ruling of the German constitu- 
tional court 41 . 

In conclusion, the public character of 
an assembly is important for its perceived 
goal as collective usage of the freedom of 
expression. Therefore, a protest in a non- 
public location does not fit the definition 
of an assembly in most cases. 

3.3. Relation of DDoS to 
Fundamental Rights 

Since the European Convention on Hu- 
man Rights is from 1950, the right to a 
digital assembly is obviously never gran- 
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ted explicitly. However, as the medium 
or infrastructure which is used to execute 
the right to assembly 42 is never explicitly 
mentioned, one could argue that an as- 
sembly executed over a digital medium, 
e.g. the Internet, may well be allowed, 
taking into account the restrictions on the 
right 43 . 

As a DDoS appears most as a type of 
blockade, the notes on blockades as a form 
of assembly are very relevant. Further- 
more, this leads to interpreting virtual sit- 
in - not necessarily following the definition 
of virtual sit-in as proposed by th e Elec- 
trohippies Collective (Klang 120051 ) - also 
as a type of blockade. Thus, we will inter- 
pret the DDoS - and the related virtual 
sit-in - using the doctrine of blockades and 
sit-ins as methods of assembly. 

By approaching the DDoS as a block- 
ade, we first need to see if it fits in the 
broad definition of an assembly. Thus, the 
character of collective usage of the free- 
dom of expression must be prevalent. If 
this is true, we learn that a DDoS may 
well be protected, albeit with very strict 
restrictions. To start, the DDoS may in 
no way be a method to force a party to 
a decision or action. Finally, the interests 
of the party that is subject to the DDoS 
must be well-balanced against the goal 
pursued by the protesting party, thereby 
taking in account possible different meth- 
ods to pursue this goal and the propor- 
tionality between the damages and the 
pursued goal. 

As discussed before, the public char- 
acter of an assembly is very important. 
Therefore, if a DDoS does only result in 
downtime, without the public having any 
idea of the goals the protesters pursue, it 
cannot be deemed an assembly. 



3.4. Individual versus Collective 
Actions 

As discussed before, the Dutch constitu- 
tion recognises the right to assembly and 
manifestation 44 . However, it does not 
make a distinction between individual and 
collective assemblies - being computer sci- 
entists, we consider an empty set still 
as a set. Nevertheless, the Dutch legis- 
lator gives collective meaning to the defin- 
ition of assembly 45 . Furthermore, the 
European Convention on Human Rights 
does not make this distinction either , 
nor does it distinguish between the right 
of assembly and collective freedom of ex- 
pression 47 . 

The Dutch Public Manifestations Act 
does not provide direct clarification on the 
difference between individual and collect- 
ive actions 48 . However, this act does reg- 
ulate that every municipality could have 
a different implementation strategy of the 
act in local regulations 49 . Therefore, it 
is possible that one municipality makes 
a distinction between collective and indi- 
vidual protest and the other does not. 

In practice, accor ding to Embregts and 
Nieuwenhuys (|2007l ). there is a difference 
in the right to protest as individual versus 
the right to protest as a collective. As an 
individual protests, this is not a case for 
the right of assembly, but for the right of 
free speech 50 . Therefore, the Public Mani- 
festations Act is not applicable. There are 
two exceptions. First, when other indi- 
viduals spontaneously join the protest it 
becomes an assembly. The second excep- 
tion is when the individual protest is dur- 
ing another protest. 

In conclusion, a strictly individual 
manifestation is protected by the free- 
dom of speech and is not considered an 
assembly. Therefore, individual actions 
are even better protected by fundamental 
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rights than collective actions, as there are 
more safeguards implemented. 

3.5. Boundaries on the 

Fundamental Rights of 
assembly 

In 2007, the Dutch ombudsman released a 
report in which the boundaries for a phys- 
ical demonstration as described by the 
Dutch public manifestations act 51 are cla - 
rified (Embregts and Nieuwenhuvs l2007h . 
The ombudsman states that, although 
protesting is a fundamental right, this 
right may be infringed if the protest dis- 
proportionally disrupts security, health or 
property. The boundaries given by the 
ombudsman could be a good base for test- 
ing the digital protest. The first import- 
ant boundary is that there is a registration 
period of 4 days for a collective protest. 
This makes it possible for the object pro- 
tested against to enforce an injunction 
if it thinks the protest disproportionally 
harms his interest. 

The second interesting point is that 
the identification duty 52 is wid ened (Em- 
bregts and Nieuwenhuys 2007). The pro- 
tester does not have to be suspected of a 
criminal offence, but could be enforced to 
identify himself as part of the protection 
of order - even if the police already knows 
the suspect. For regulating purposes, the 
law enforcement authorities appreciate a 
scheme from the organisation about the 
way the protest is organised. This, how- 
ever, is not an obligation. 

A third interesting aspect is that in- 
tervention of the police when the protest 
is near an (important) government build- 
ing i s allo wed (Embregts and Nieuwen- 
huys Hqq3). a restriction is that it is for- 
bidden to use tools which could be used 
as weapons - such as sticks - during the 



protest. This restriction could have in- 
teresting implication in a digital protest. 
The last obligation to the protest is that 
the protesters have to leave the location 
of protest clean after the action. This 
could also have interesting implication for 
a digital protest. Finally, the government 
has a department for facilitating manifest- 
ations and assemblies. 

4. Criminal Law and 
Availability Attacks 

The Budapest Convention on Cybercrime, 
which entered into force in 2004 and 
was enacted in the Netherlands in 2007, 
urges the national governments to crim- 
inalise the intentionally and without right 
hindering the functioning of a computer 
system inputting, transmitting, dam- 
aging, deleting, deteriorating, altering or 
suppressing computer data 53 . At the 
time of ratification, most Dutch law was 
already in line with the convention 54 , part 
of the pending act Computercriminalitcit 
II 55 - either originally or as an exten- 
sion due to the convention. As the name 
suggests, at this time, there already was 
an act called Computercriminaliteit 56 , 
which, amongst others, contained the first 
criminalisations of attacks on the availab- 
ility of automated systems. 

Dutch law has several criminalisations 
of attacks on the availability of automated 
systems. To start, the intentionally ren- 
dering unavailable of an system for tele- 
communications is punishable with up to 
a one year sentence if this affects the 
transmission, storage or processing of data 
within a public telecommunication net- 
work or a public telecommunication ser- 
vice; punishable with a sentence of up to 
six years if this damages goods or ser- 
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vice; punishable with a sentence of at most 
nine years if this endangers life; and pun- 
ishable with a sentence of up to fifteen 
years if this led to death 57 . If the act was 
unintentional, sentences drop to at most 
six months in the first two cases, up to 
one year in the third case, and at most 
two years imprisonment in the last case 58 . 
The legislator notes that these articles also 
criminalise the creation of unavailability 
by sending a lot of data to some electronic 
address 59 . 

The two offences discussed in the pre- 
vious paragraph where introduced as the 
modern society became more and more de- 
pendent on automated systems 60 . The le- 
gislator even thought computer networks 
to be so important that a strike was not 
accepted as an exception to the offences. 
Nevertheless, it is later clarified by the 
Dutch legislator that this article is only 
concerned with automated systems of gen- 
eral interest 61 . Furthermore, it is also 
noted that it is not focussed on cases 
where there only is slight interference and 
no real damage to the services. 

Furthermore, it is not allowed to in- 
tentionally and without right make data 
unavailable that is stored using an auto- 
mated system 62 . If this is done with hack- 
ing the sentence goes up to four years 63 , 
and without up to two years . 

Finally, a sentence of at most one year 
can be given for the intentionally and 
without right making unavailable of an 
automated system by sending or offering 
it data 65 . One of the main motivators for 
this article was spamming 66 . 



161sexies of the Dutch penal code 67 , as 
it overloads the network thereby affect- 
ing the complete automated work 68 . Fur- 
thermore, in this specific case one website 
was attacked, but the attack resulted in 
downtime at other clients of the internet 
service provider that hosted the attacked 
website, which caused the judge to finding 
the second part of the article also applic- 
able, as the services offered where broadly 
interrupted 69 . 

In the higher appeal of these cases was 
referred back to the comment of the legis- 
lator that the articles the conviction was 
based on where relevant , even though 
the article of the Dutch penal code spe- 
cifically meant for DDoS attacks 71 was 
still pending in parliament 72 . The other 
higher appeals had a comparable out- 
come 73 . 

However, another case from 2005 74 led 
to acquittal for the court of appeal 75 . The 
main motivation was that the court de- 
cided it to be not proven that the net- 
work of the given internet service provider 
was endangered, only the specific system, 
which made the court decide that article 
161sexies of the Dutch penal code 76 was 
not applicable. 

From the case law, we can learn that in 
order to be convicted on the basis of art- 
icle 161sexies of the Dutch penal code 77 , 
at least an automated system of network 
general interest needs to be endangered 78 . 
Nevertheless, in cases where other web- 
sites beside the website that is subject of 
the ddos experience downtime, the article 
is applicable again 79 . 



4.1. Case law 

In 2005, the local court in The Hague 
decided that a DDoS attack may well 
be punished under the conditions of the 
first part of the first member of article 



4.2. Grounds of Justification 

Mevis <|2009h notes that the Dutch Penal 
Code provides two types of grounds for 
exclusion of criminal liability. Namely, 
grounds for justification - grounds which 
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regard the wrongfulness of the act - and 
grounds for excuse - grounds which regard 
the culpability of the actor. Of these, only 
the first type is of interest to our research, 
as we are not interested in personal cir- 
cumstances, but only in the general act. 

Especially Force Majeur 80 is of relev- 
ance. This article provides, due to the 
case law, both a ground for j ustifi cation 
as a ground for excuse (Mevis |2009|). The 
ground of justification created by this art- 
icle, also known as state of emergency, jus- 
tifies punishable behaviour when there is 
a conflict between the duty to solve an 
emergency and the duty to comply with 
the law - given that the emergency is sub- 
stantial in pro portio n to the criminalisa- 
tion 81 . Mevis (|2009T l illustrates this type 
of Force Majeur using a case where an op- 
tician broke the law by opening his store 
outside of the allowed shopping hours in 
order to provide a client in dire need with 
a pair of glasses 82 . 

In some cases, the description of an 
offence contains the requirement that i t 
happened without right (Mevis 2009). 
The legislator normally adds this require- 
ment when the described offence also fre- 
quently happens rightfully. The addition 
of without right requires the public pro- 
secutor to explicitly prove that the action 
was without right, whereas if this is omit- 
ted, the action is always considered to be 
without right, unless the defence submits 
a ground for justification. In other words, 
the burden of proof with regard to justi- 
ficatory grounds is changed by the addi- 
tion of without right. For example, the 
description of the offence destruction 83 
contains the requirement without right, 
which, amongst others, clears honest de- 
molition companies of the possible crim- 
inal charge of destruction. 

As discussed before, one of the offences 
commonly charged in cases concerning a 



form of DDoS does not require the of- 
fence to be without right 84 . Furthermore, 
the legislator claims to have omitted this 
requirement due to the dependability on 
automated systems and networks in our 
modern society 85 . 

Mevis (2009) also mentions absence 
of substantive wrongfulness, which is an 
implicit ground for justification. This 
provides a ground of justification when the 
act perfectly fits the description of the of- 
fence, but the offender objectively acted 
in favour of the cause the criminalisation 
tries to pursue 86 . However, this does not 
fit idealistic causes 87 . Therefore, it is not 
an applicable ground of justification in the 
present research. 



Policy of the Public 
Prosecutor 



As Mevis ( 20091 ) discusses, the public pro- 
secutor may choose not to prosecute 88 . In 
practice, there is the possibility of tech- 
nical dismissal - when it is not likely the 
prosecution will lead to a conviction - and 
the dismissal on the basis of the expedi- 
ency principle 89 - when the public prosec- 
utor decides prosecution is not opportune. 

When the public prosecutor considers 
a conviction possible, but thinks prosec- 
ution is not in favour of the general in- 
terest, he may decide to a dismissal out of 
opportunity, as he conside rs pro secution 
not to be opportune (Mevis 20091 ) . This is 
due to the fact that Dutch criminal law 
is based on the principle of opportunity, 
as opposed to the principle of legality - 
as German criminal law is. Such a de- 
cision that prosecution is not opportune 
is a decision of policy. Furthermore, the 
public prosecutor may create guidelines, 
which describe when he will not prosec- 
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ute. Thus, a decision to tolerate a certain 
crime may be formulated in the form of 
such a guideline - a common example in 
Dutch criminal law is the policy on soft 
drugs 90 and euthanasia 91 . 

Recently, the Public Prosecutor ordered 
two suspects of performing a DDoS on the 
websites of MasterCard and VISA to com- 
munity service 92 . These actions were - 
allegedly - performed with political reas- 
ons, namely the blocking of donations to 
WikiLe aks by these cr edit ca rd companies 
(Teffer l2010bl : Teffer l2010af ). The public 
prosecutor decided not to prosecute the 
suspects under one of the offences dis- 
cussed in Section^]- most notably 161sex- 
ies of the Dutch penal code 93 -, but use 
their competence to give a punishment or- 
der 94 - which is allowed for offences penal- 
ised with up to 6 years of detention. The 
underage offender was ordered to 26 hours 
of community service, whereas the older 
suspect was ordered to 80 hours of com- 
munity service. 



6. Civil Disobedience 

After discussing the (D)DoS method with 
respect to the European rights, criminal 
law and the policy of the public prosec- 
utor we decided to analyse the (D)DoS 
method with respect to civil disobedi- 
ence to harvest (more) requirements which 
could bind a legal requirement. 

With civil disobedience, we mean events 
in which citizens disobey the law, cl aimin g 
to do so for a greater good (Klang[2005). 
An example of civil disobedience can be 
found in Rosa Parks, who, in 1955, refused 
to give up her seat in the bus to a white 
man, whereby she broke the law. 

She performed this action, to oppose 
against discrimination and thereby break- 
ing the dogma of racial differences. 



In this s ection the guidelines provided 
by Schuyt ( 1972h will be discussed in the 
context of digital civil disobedience. His 
first guideline prescribes that the violation 
of law should be the result of a process of 
deliberation. Therefore, the time and aim 
of the action may not have a spontaneous 
character. This guideline could be adop- 
ted in the digital infrastructure without 
the loss of generality. 



The second guideline of Schuyt (|l972n 
describes that there must be a relation 
between the method chosen to protest and 
the objective of the protest. Therefore, if 
the objective of protest concerns the phys- 
ical infrastructure, then a digital protest 
is not eligible until a later stage, when the 
physical options are exhausted. However, 
if the objective concerns the digital infra- 
structure, then a digital protest is appro- 
priate. 

The third guideline prescr ibes p ublic vi- 
olation of the law (Schuyt Il972h . If the 
protester does not try to hide his actions, 
he stands stronger in influencing the pub- 
lic opinion. A typical DDoS attack could 
be anonymous and mere downtime does 
not express much opinion. Therefore, this 
guideline needs technical adaptation when 
imposed on DDoS as an assembly. Fur- 
thermore, this also fits with the public 
property that the Dutch legislator notes 
of assemblies 95 . 

Besides the requirement that the vi- 
olation shoul d have a public character, 
Schuyt (|1972l ) also requires voluntary co- 
operation when prosecuted. Therefore, 
the disobedient protester should not use 
a proxy or other means of hiding and has 
to store (forensic) evidence to be able to 
cooperate with possible prosecution 



As a fifth requirement, Schuyt (|1972f ) 
notes the absence of violence. Although 
the technique of DDoS is classified as an 
attack, it does not necessarily cause phys- 
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ical harm to individuals or property - al- 
though it is possible. However, if the tech- 
nique is used against critical systems as, 
for exa mple, SCADA systems (Cai, Wang 
and Yu l2008T L it could create major phys- 
ical damage. Since the protester is not al- 
ways able to decide whether a system he 
blocks is important - for example, when 
a website is run on the same mainframe 
as a critical system -, the protester has 
the responsibility to exclude this risk. In 
Section [8j we will discuss both technical 
and juridical requirements to mitigate this 
risk. 

A long manifestation could harm the in- 
terests of other citizens, which could vi- 
olate the sixth requirement: the rights 
of others citizens should be respected as 
much as possible. Nevertheless, this, 
again, boils down to an act of balancing 
the interests of all involved parties. 

The seventh requirement from Schuyt 
(|1972| ) prescribes that all legal resources 
need to be exhausted. One should not 
directly resort to civil disobedience, but 
first seek to use other resources such as 
influencing the public opinion, trying to 
enforce your rights in court, and the likes. 
This requirement does not differ from the 
physical world, because most of the legal 
resources are constituted in the physical 
world. 

The disobedient citizen has to accep t 
the risk of being punished (Schuvt [l972h . 
For common violations (e.g. entering 
private terrain or temporary occupation) 
the maximal punishment could be accept- 
able to the disobedient. However, the 
punishment for a DDoS could be 6 years. 

Finally, the disobedient citizens is act- 
ing as he does to provoke a trial case in 
court, in order to test his moral grounds 
of justifications for a judge. 



7. Recap of Current 
Legislation 

To get a good picture of the status 
quo of digital manifestation in Dutch 
and European legislation, we performed a 
thorough legal study. At this point, we 
will summarise the results of the legal part 
of the research and give a brief description 
of the current status of the digital right to 
assembly. 

In Section [21 we have seen under which 
conditions the DDoS may be considered 
as a method of exercising the right to as- 
sembly. To start, the DDoS has to fit 
the description of an assembly, which re- 
quires it to have a public character and 
to have a prevalent character of collective 
expression of opinion (definition). Fur- 
thermore, the DDoS can be seen as a vir- 
tual blockade - and, thus, virtual sit-in. 
This gives the following requirements for 
a DDoS to be considered as covered by the 
right to assembly: reasonable alternatives 
have already been pursued (subsidiar- 
ity), the (possible) damages of the mani- 
festation are proportional to the interests 
of the party subject to the protest (pro- 
portionality), and the protest is in the 
general interest (necessary). As we have 
also seen, in Germany it would be required 
that the blocking effect of the DDoS is a 
side effect of a normal peaceful assembly, 
which will commonly not be the case. 

Especially the requirement of visibility 
makes it hard for a DDoS to be deemed 
a reasonable blockade, as this would re- 
quire artificial interventions, such as the 
use of social networking, microblogs or 
comparable services, where the protesting 
citizens unite. As the activity should have 
a character of publicly collectively exer- 
cising the freedom of expression and not 
of hindering services, a loosely connecting 



13 



campaign on a social networking site could 
be seen as the assembly, but the DDoS 
itself would still be questionable. How- 
ever, their may be variants possible that 
withstand this requirement, such as flood- 
ing an email-address or contact form with 
the message of the protest. Please note 
that requirements considering the balan- 
cing of interest or the pursuing of the goal 
through other means make it less likely for 
a DDoS to be considered as means of ex- 
ercising the right to assembly in practice, 
they do not make the change for that to 
happen negligible. 



As we saw in Section 21 the DDoS is 
criminalised in Dutch legislation. How- 
ever, it is not completely unambiguous 
which offences in particular fit the bill in 
general, which leaves this task to case law. 
Due to the omission, of without right in 
the most commonly used offence, any ac- 
tion that fits the description is considered 
to be without right. In combination with 
the importance the Dutch legislator has in 
mind, when it comes down to information 
networks, it seems unlikely the court will 
allow an appeal to necessity as a ground 
of justification using the right to assembly 
in a DDoS case. 



Therefore, we can safely assume that, 
in most cases, it is not possible to call 
upon the right to assembly for a DDoS 
attack. Furthermore, there currently is no 
policy of the public prosecutor considering 
digital rights, which we discussed in Sec- 
tion [5j Nevertheless, the door is still open 
to the in Section [6] discussed phenomenon 
of civil disobedience. 



8. Embodying the Digital 
Right to Assembly in 
Legislation 

For the next step in this research, we will 
ask ourselves to what extent digital as- 
semblies should be possible and how this 
should be embodied in the current legis- 
lation. As the first question - whether 
the digital assembly should be possible - 
is mostly a political question, we will fo- 
cus on the second question. In order to do 
this, we will first evaluate if this requires 
extending or creating fundamental rights, 
followed by the possibility of the public 
prosecutor issuing a special policy. 

8.1. Extending Current Rights 

In the Dutch constitution, the secrecy 
of co rrespondence is granted 96 (Asscher 
1999). As this only protects written let- 
ters, telegraphs, and telephone conversa- 
tions, it is not of use for other forms of 
communication. However, nowadays, the 
right to privacy 97 is understood as also 
including private communication. Thus, 
privacy was extended to fill the gap of the 
secrecy of correspondence of other forms 
of communication. In analogy to this ex- 
ample, we will evaluate whether an exten- 
sion of the existing fundamental rights is 
feasible. 

As discussed in Section [3J the Dutch 
constitution grants the right to assembly 
and manifestation 98 , as opposed to the 
European Convention on Human Rights, 
which only grants the right to assembly 99 . 
Merely the addition of a right to mani- 
festation to the right to assembly may en- 
able digital assemblies under strict condi- 
tions - that fit in with the requirements 
we will discuss in Section [9] Furthermore, 
this solution clarifies the general place of 
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the manifestation, which lies somewhere 
between the right to assembly 100 , the right 
to freedom of expression 101 , and the right 
to association 102 . 

There are two noteworthy risks with 
extending existing rights. Firstly, most 
rights form a foundation for other legis- 
lation that builds on it, which leads to 
difficulties when those rights are changed. 
Secondly, it can feel as if the legislator 
tried very hard to fit in additional rights 
with current legislation, when there actu- 
ally are enough differences to justify intro- 
ducing a new right. 

8.2. Creating New Rights 

When the Dutch government found that 
intrusion into information systems was 
not punishable under trespassing, the le- 
gislator decided to create a new offence 
for intrusion into information systems 103 . 
The new offence is based upon the offence 
of trespassing, but is also an adaptation 
to the digital world. With this example 
in mind, we will discuss the creation of 
a new fundamental right to enable digital 
assemblies. 

The discussed right to manifestation 
could also be introduced as a separate 
right, which has some benefits. Most not- 
ably, this makes the right truly separate 
of previous rights, and does not give it the 
position of little brother in comparison to 
the right to assembly. Furthermore, this 
leaves room for a more specific approach 
to the right and its safe guards. 

The most notable backside to introdu- 
cing new rights is that this eventually 
leads to devaluation due to the existence 
of too much fundamental rights. However, 
it seems that the right of manifestation is 
recognised highly, and thus not capable of 
causing such devaluation. 



8.3. Policy of the Public 
Prosecutor 

As we discussed in Section [SJ it may be 
possible to protect the digital assembly 
by policy of the public prosecutor. As 
policies of the public prosecutor are a typ- 
ical Dutch phenomenon, this approach is 
not very useful in the global issues gen- 
erated by the digital world. However, it 
may be of use as a temporary solution. 

9. Requirements for Digital 
Assemblies 

A digital assembly should comply with a 
number of requirements. To find these re- 
quirements, we will look back at the gen- 
eral doctrine on assemblies and try to ad- 
opt this to the general world. In addition, 
we will consider differences between the 
digital and the physical world and try to 
find requirements that settle these differ- 
ences. 

In Appendix [A] the relations of the sev- 
eral proposed requirements to each other 
and the general doctrine are displayed 
graphically. These figures are referred for 
a more detailed overview of the require- 
ments. 

9.1. Defining Digital Assemblies 

We have seen that the Dutch legislator 
considers a manifestation as a group of 
people that publicly expresses their emo- 
tions or wishes concerning a social or 
political subject 104 and that the German 
constitutional court decided that an as- 
sembly should be interpreted as an orderly 
gathering of people participating in the 
public building of opinion, with a focus on 
discussion or manifestation 105 Our idea of 
a digital assembly will build further upon 



15 



these perceptions. Thus, we will consider 
visibility, the expression of opinion, and 
collectivity as requirements. 

9.1.1. Visibility 

That assemblies should be visible is one 
of the major requirements to an assembly, 
as this can make the difference between 
an action where the goal of hindering is 
prevalent and an action where the goal 
of publicly expressing an opinion prevails. 
The same goes for a digital assembly. 
Thus, the public should be able to see the 
opinion that the assembly tries to express. 

9.1.2. Expression of Opinion 

Besides being public, in an assembly the 
goal of collectively expressing an opinion 
should prevail. This means that a digital 
assembly should be politically or socially 
motivated, and not be aimed at, for ex- 
ample, smear campaigns 106 . 

9.1.3. Collectivity 

The collective character of an assembly is 
one of the reasons of its power. If a very 
large group of citizens opposes a certain 
decision, they are more likely to be heard, 
than if an individual does. 

However, in the digital world, automa- 
tion is cheap. Thus, one could act as if 
he is a group of people. Therefore, the 
requirement of collectivity prescribes the 
one man, one vote principle. 

Furthermore, a certain proportionality 
between the size of the target and the size 
of the participants in the assembly and the 
impact of the assembly is important. In 
other words, assemblies require a certain 
critical mass, in order to be of effect. 



9.2. Permissibility of Digital 
Assemblies 

The court evaluates the permissibility of 
an assembly on several conditions. First 
of all, the action may not be a method 
to force some party to a decision or ac- 
tion - please note that this is also in line 
with the general requirement that the ex- 
pression of opinion should be a prevalent 
characteristic. Secondly, the goal pursued 
by the protesting party should be well- 
balanced against the interests of the other 
party, especially concerning possible dam- 
ages. Finally, other possible methods to 
pursue the goal should have been taken 
into account or tried. 

9.2.1. No Coercion 

As stated before, the non-permissibility 
of coercion lies also with the requirement 
that an assembly is mainly about the ex- 
pression of opinion and not about hinder- 
ing or comparable goals. Of course, there 
is a slight difference, as the assembling 
party may try to force the opposing party 
with social pressure to follow the opin- 
ion they are expressing. However, forcing 
them at gunpoint is obviously not per- 
missible at all, and can be considered a 
form of coercion. 

9.2.2. Proportionality 

As we have seen before, proportionality 
is always an important consideration. In 
this case, it is of great importance that 
there is a balance between the goal that is 
pursued and the interests of the party that 
is subject to the protest. For example, 
if a protest aims at a local milk factory 
which actually is bound by the decisions 
of the municipality, the protest may not 
be proportional. However, if it was their 
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own decision that caused the protest, it 
may be proportional. 

The same reasoning could be used for 
damages. A small wrong does not justify 
a lot of damages, but a large issue may. 
Proportionality between the pursued goal 
and the potential damage to the interests 
of the opposing party is, thus, an import- 
ant requirement. For this, the practicalit- 
ies can be left to the judge. 

9.2.3. Subsidiarity 

An assembly - especially a more intrusive 
one - should probably not be the first an- 
swer when someone feels their interests - 
or opinions - are not heard. It is import- 
ant that those that want to express their 
opinion have followed other possible paths 
in the pursue of their goal, before they 
step up to more heavier methods, such as 
the assembly. Therefore, it is important to 
evaluate whether other methods of reach- 
ing the intended goals are sufficiently ex- 
hausted. 



This leads to a central organisation for 
each assembly, which also announces the 
activity. Furthermore, the police will 
provide supervision, which will take action 
when individuals step beyond the law. 



9.3.1. Supervision 

Within a physical demonstration, the 
presence of law enforcement officers is 
a preventive measure against escalation. 
The officers can inform the mayor about 
the status of the protest, providing him 
with information to make a decision 
whether the protest should be broken up. 

This requirement is hard to satisfy, 
since the anonymous nature of the Inter- 
net prevents it, although it could be sat- 
isfied when part of the infrastructure is 
provided by the government. Neverthe- 
less, chances are fairly high that this infra- 
structure raises distrust and may for that 
reason not be used. 



9.3. Enabling Orderly Digital 
Assemblies 

Finally, there are requirements which 
make digital assemblies orderly. These re- 
quirements arc of a lower importance, as 
they are not as much build on the legality 
of the digital assembly, but say something 
about the ability to keep order. This is 
not only beneficial for the authorities, but 
also for the protesters, as they have less 
chance of their assembly getting hijacked 
for violent or otherwise unwanted reasons. 

In practice, the municipality regulates 
the held ma nifest ations (Embregts and 
Nieuwenhuys 12007 ) . Although most of the 
regulations by the municipality are not 
strictly required, protesters are urged to 
comply with them, to prevent excesses. 



9.3.2. Central Organisation 

Most of the larger manifestations have a 
central organisation. This organisation re- 
gisters the manifestation with the muni- 
cipality and tries to help the law enforce- 
ment to keep the organisation orderly. 
However, in Section 13.51 we saw that it 
is not required to register a manifestation 
nor to have a central organisation. 

Even a digital assembly requires some 
sort of announcement to gather those who 
want to protest at the right time, for the 
protest to be successful. After this ac- 
tion, the protest can be considered re- 
gistered. In addition, details of the mani- 
festation could be provided using some 
sort of pseudonymity or anonymity. 
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9.3.3. Announcement 

Commonly, the municipality asks its cit- 
izens to register manifestations. Although 
this is not always required - for ex- 
ample, ad hoc manifestations cannot be 
registered -, this is an interesting require- 
ment to discuss, due to the risk of miscon- 
figuration of a system, which could lead to 
much extremer effects than expected in a 
normal situation. 

An announcement should be unambigu- 
ous and provably delivered to the legal 
subject who is subject to the manifest- 
ation. This gives the legal subject of 
protest the option to ask for a delay or 
rejection by filing an injunction in court. 
The time granted by the judge should be 
sufficient to prevent great disaster. How- 
ever, it should not be sufficient to disarm 
the protesting party. For example, if the 
subject of the protest does not repair the 
misconfiguration, the protest will be al- 
lowed at some point. Please note that, in 
this example, this badly configured server 
is targeted, not the misconfiguration itself. 



10. Technical 

Requirements for 
Digital Assemblies 

In this section, we will discuss the tech- 
nical requirements, based on the legal 
requirements, to make digital assemblies 
possible. Based on the requirement of vis- 
ibility, we will introduced a technical re- 
quirement concerning visibility. The re- 
quirement of collectivity brings us to in- 
troduce one man one vote, and group pro- 
portionality as technical requirements. 

We will also consider additional require- 
ments that provide for an orderly as- 
sembly. From the legal requirement of su- 



pervision, we come to the use of revocable 
anonymity. Finally, although we noticed 
the existence of central organisations in 
Section T9.3.21 technically we acknowledge 
the importance of a decentralised solution. 

10.1. Visibility 

A concrete example, which satisfies the 
visibility requirement, is protesting by e- 
mail. If a digital assembly is shaped in 
the form of sending multiple e-mails at a 
predefined time as a group, it will have 
the properties of an attack on the availab- 
ility of a system. Furthermore, if enough 
individuals participate in sending e-mails 
with, for example, large attachments and 
prevention against technical countermeas- 
ures, such as spam filters, the content is 
clearly visible to the subject of the protest. 

The visibility becomes even stronger if 
carbon copies are used, in order to send a 
copy of the e-mail to a public place, wher e 
it is for everyone to see (Resnick l2008h . 
The i-box of the party that is subject to 
the protest may become so full that it is 
not feasible to use at that moment. Even 
stronger, the memory of the mail server 
could fill up and cause the server to crash, 
which is a (D)DoS by definition (Bass 
ct al. 1998f ). A recent example of such a 
protest over e-mail is when a Dutch mem- 
ber of the European Parliament placed 
a call on citizens to send protest e-mails 
against ACTA to all the members of the 
European Parliament . 

Within a physical demonstration, the 
ground where the protesters assemble is 
impervious for other people. However, 
when they watch the assembly from above 
- e.g. from a building - or from the side, 
they can clearly see the statements of the 
group. Beside carbon copying protest e- 
mails to publicly accessible boards, social 
media could get filled with the collectively 
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expressed opinion of the manifestation. 

10.2. One Man, One Vote 

The infrastructure must ensure that each 
person has at most one vote - e.g. one 
device - in the manifestation. In the ex- 
ample of one device, this device may not 
be able to generate more than the average 
of possible request, i.e. super computers 
are not allowed. 

This requirement mainly ensure s that 
the use of bot-networks (Rajab et al. l2006T ) 
or hired server park capacity does not be- 
come legal for the use of protesting. It also 
contributes to the requirement of group 
proportionality on which we will elabor- 
ate in Section fl . 3 1 

10.3. Group Proportionality 

The impact of the assembly should be pro- 
portional to the size of the target and the 
size of the group of participants to the as- 
sembly. Therefore, it should not be pos- 
sible for one person to take down another 
party single handed - e.g. by exploiting a 
vulnerability. Comparably, a small group 
of protesters should not be able to take 
down a corporation that is much larger. 
Thus, the used techniques should com- 
ply with this requirement of group pro- 
portionality. 

10.4. Revocable Anonymity 

An important requirement for a protest is 
that the protesters are anonymous. How- 
ever, when one of the protesters abuse 
the anonymity by, for example, trying to 
hack the server, the investigative authorit- 
ies should be able to track this individual 
down. Since these authorities should not 
be able to track the whole group down or 
otherwise abuse this procedure, revocable 



anonymity can be put i n plac e (Kpsell, 
Wendolsky and Federrath 20061 ). 

For revocable anonymity to work, some 
entity needs to be in charge of revoca- 
tion. This can be implemented in multiple 
ways. For example, critical mass based re- 
vocation could be used, where the protest- 
ers give up on people trying to disturb the 
event. 

10.5. Decentralised 

As a non-negligible amount of the mani- 
festations is aimed at the government, 
people may not have trust in a infrastruc- 
ture which is actively maintained or sup- 
plied by that same government. There- 
fore, it may not be effective for a gov- 
ernment to straightforwardly implement 
these requirements. 

Furthermore, as decentralisation is in 
the very veins of the Internet, the di- 
gital assembly infrastructure should be as 
decentralised as possible, thereby omit- 
ting central contributors to the infrastruc- 
ture, such as the government. In addition, 
the government should only contribute to 
parts that are necessary for law enforce- 
ment in the case a manifestation escalates. 



11. Conclusion 

In this paper, we have investigated the di- 
gital right of assembly, especially consid- 
ering attacks on the availability of inform- 
ation systems as assembly, e.g. the DDoS. 
This lead us to conclude that, in most 
cases, such attacks cannot be deemed a 
means of exercising the right to assembly. 
This is due to the fact that such attacks, 
which can be seen as digital blockades, 
do commonly not have a public character. 
Furthermore, the Dutch legislator argues 
that the digital infrastructure is of such 
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importance that attacks on the availabil- 
ity of information systems should almost 
always be unlawful. 

We learned that an effective way of cre- 
ating the right to digital assemblies can 
be found in granting the right to mani- 
festation, which is currently only granted 
by the Dutch constitution 108 and thus not 
invocable in court 109 . 

Finally, we discussed the requirements 
that should be met to conform to the 
definition of a digital assembly - visibil- 
ity, expression of opinion, and collectiv- 
ity -, which resulted in the technical re- 
quirements of visibility, one man one vote, 
and group proportionality. We also noted 
requirements for a digital assembly to 
be permissible, namely a lack of coer- 
cion, proportionality, and subsidiarity. Fi- 
nally, we found that digital assemblies can 
be held orderly by implementing revoc- 
able anonymity, acknowledging decentral- 
isation, and allowing some means of an- 
nouncement. 

11.1. Further Research 

Some of the threads started in this paper 
are of interest for future research. Digital 
assemblies also have a social component. 
In future research, the social influences of 
a digital assembly and the power this gives 
to the participants should be studied. Re- 
lated to this, the dynamics of group pro- 
portionality, as proposed in Section 110.31 
could be evaluated. 

The proposed fundamental rights 
should be further evaluated. The inter- 
sections between the digital assembly and 
the Budapest Convention on Cybercrime 
also require further research. This could 
be extended to the related directions and 
regulations of the European Union. 

The issue of jurisdiction will continue 
to be of high importance, especially when 



it concerns digital topics. In this case, 
it should be explored what happens when 
the European legislator grants its citizens 
the digital right to assembly and the gov- 
ernment of the USA does not grant this. 
This question could also be expanded 
to collaboration between the European 
Union and the USA in police activities. 

Some legal requirements are not eas- 
ily translated to technical requirements, 
due to their nature. However, this does 
leave gaps, as shown in the figures in Ap- 
pendix [21 Therefore, we recommend fur- 
ther research on this translation, with a 
focus on those topics that are not suit- 
able for direct translation to technical re- 
quirements. Additionally, several tech- 
nical topics are worth further pursuance, 
such as the implementation of revocable 
anonymity. 
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A. Relations of the 
Requirements 

In figure [l] the relations of the require- 
ments of the proposed definition of a di- 
gital assembly are displayed. Figure [2] 
does the same for the requirements con- 
cerning the permissibility of a digital as- 
sembly. Finally, figure [3] concerns the re- 
quirements for orderly digital assemblies. 
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Figure 1: Relations of the requirements of the proposed definition of a digital assembly. 
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Figure 2: Relations of the requirements concerning the permissibility of a digital 
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Figure 3: Relations of the requirements to an orderly a digital assembly. 
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